Start all children in their own PID namespace.

content/common/sandbox_linux/sandbox_linux.cc

Index: content/common/sandbox_linux/sandbox_linux.cc
diff --git a/content/common/sandbox_linux/sandbox_linux.cc b/content/common/sandbox_linux/sandbox_linux.cc
index 5eee4e1d6c14d47e785a0ac42e4c8a77a93d6383..3e681a94d44f0d1154ba527fd8af361ebd9e84c6 100644
--- a/content/common/sandbox_linux/sandbox_linux.cc
+++ b/content/common/sandbox_linux/sandbox_linux.cc
@@ -186,7 +186,12 @@ void LinuxSandbox::EngageNamespaceSandbox() {
   // Note: this requires SealSandbox() to be called later in this process to be
   // safe, as this class is keeping a file descriptor to /proc/.
   CHECK(sandbox::Credentials::DropFileSystemAccess(proc_fd_));
-  CHECK(sandbox::Credentials::DropAllCapabilities(proc_fd_));
+
+  // We do not drop CAP_SYS_ADMIN because we need it to place each child process
+  // in its own PID namespace later on.
+  const std::vector<sandbox::LinuxCapability> caps(
+      1, sandbox::LinuxCapability::kCapSysAdmin);

[jln (very slow on Chromium), 2015/03/24 22:03:34]

Why the value 1? That's CAP_DAC_OVERRIDE, right?

[rickyz (no longer on Chrome), 2015/03/25 22:47:46]

This is an ugly way to initialize the vector with a single element (the one is
the number of times to repeat the value) - unfortunately
{sandbox::LinuxCapability::kCapSysAdmin} doesn't work in the one-element case
:-(

[jln (very slow on Chromium), 2015/03/25 23:47:50]

Ooch, misread that.

I can't understand why this wouldn't work. Did you do std::vector<X> caps
({sandbox::LinuxCapability::kCapSysAdmin});

"const std::vector<X> caps {sandbox::LinuxCapability::kCapSysAdmin};" should
work as well, but is more ambiguous and problematic (uniform initialization
syntax vs initialization lists).

That being said it's currently disallowed for technically being a "library
feature" :( (https://chromium-cpp.appspot.com/).

What would you think about doing a horrible-ugly push_back() instead? I suspect
I may not be the only one do mis-read this.

Up to you.

+  CHECK(sandbox::Credentials::SetCapabilities(proc_fd_, caps));
 
   // This needs to happen after moving to a new user NS, since doing so involves
   // writing the UID/GID map.